CVE-2023-6448
Unitronics VisiLogic uses a default administrative password
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Unitronics VisiLogic uses a default administrative password
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
- Record
CVE-2023-6448- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1188
- Updated
- 2026-11-02
EUVDEUVD-2023-58685
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
- Record
EUVD-2023-58685- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3r8p-3x67-72v8
Unitronics Vision Series PLCs and HMIs use default administrative passwords. An unauthenticated...
Unitronics Vision Series PLCs and HMIs use default administrative passwords. An unauthenticated attacker with network access to a PLC or HMI can take administrative control of the system.
- Record
GHSA-3r8p-3x67-72v8- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-798, CWE-1188
- Updated
- 2026-11-02
CISA KEV No score
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.
- Record
CVE-2023-6448- Weakness
- CWE-1188
- Updated
- 2026-11-02
NVD
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
- Record
CVE-2023-6448- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1188, CWE-798
- Updated
- 2026-11-02
Affected products
- unitronics visilogic
- unitronics samba 3.5 firmware
- unitronics samba 4.3 firmware
- unitronics samba 7 firmware
- unitronics vision plc and hmi
- unitronics vision1040 firmware
- unitronics vision120 firmware
- unitronics vision1210 firmware
- unitronics vision130 firmware
- unitronics vision230 firmware
- unitronics vision280 firmware
- unitronics vision290 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-6448 is a critical vulnerability (CVSS 9.8) in Unitronics Visilogic, published December 5, 2023. CISA lists it as known to be exploited, since December 11, 2023. EUVD reports exploitation since December 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.09%, the 81st percentile. No source names a fixed version.
References
cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems
unitronicsplc.com/cyber_security_vision-samba
downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf
nvd.nist.gov/vuln/detail/CVE-2023-6448
github.com/advisories/GHSA-3r8p-3x67-72v8